CVE-2023-3124

The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification in versions up to and including 3.11.6 . The root cause is a missing capability check on the update_page_option function. This security flaw allows authenticated attackers with subscriber-level capabilities to ...

CVE-2024-35656

CVE-2024-35656 is an input handling flaw in Elementor Pro (WordPress) that enables Reflected XSS in the Elementor Website Builder Pro up to version 3.21.2. The issue occurs during web page generation and affects Elementor Pro releases prior to the patched version. The connected documents identify...

CVE-2024-2121

The CVE CVE-2024-2121 affects the Elementor Website Builder Pro WordPress plugin. It enables Stored Cross-Site Scripting via the Media Carousel widget in all versions up to 3.20.1, caused by insufficient input sanitization and output escaping on user-supplied attributes. Attackers with contributo...

CVE-2024-1521

CVE-2024-1521 affects the Elementor Website Builder Pro plugin for WordPress. It enables Stored Cross-Site Scripting through an SVGZ file uploaded via the Form widget in all versions up to and including 3.20.1, due to insufficient input sanitization and output escaping. Exploitation requires auth...

CVE-2024-2781

The vulnerability CVE-2024-2781 affects Elementor Website Builder Pro for WordPress. It is a Stored XSS in the video_html_tag attribute, present in all versions up to and including 3.20.1, caused by insufficient input sanitization and output escaping. The impact, as stated, is that authenticated ...

CVE-2024-1364

CVE-2024-1364 – Elementor Website Builder Pro : Stored XSS in the WordPress plugin via the widget’s custom_id in all versions up to 3.20.1. Root cause: insufficient input sanitization and output escaping of user-supplied attributes. Exploitation requires authentication at contributor level or hig...